NY DFS Releases Revised Proposed Second Amendment of its Cybersecurity Regulation

The New York Department of Financial Services (“DFS”) released their proposed second amendment to the Cybersecurity Regulation, 23 NYCRR Part 500 (“Proposed Second Amendment”) on October 9, 2022. DFS issued a minor amendment on April 2, 2020, revising the certification of compliance date (from February to April). The Proposed Second Amendment follows DFS’s “pre-proposed” draft […]

The post NYDFS Releases Significant Enhancements to its Cybersecurity Regulation in the Proposed Second Amendment appeared first on Alston & Bird Privacy, Cyber & Data Strategy Blog.

On May 1, 2023, bitFlyer USA, Inc. (“bitFlyer”) entered into a Consent Order with the New York Department of Financial Services (“DFS”) for multiple deficiencies in bitFlyer’s cybersecurity program, most notably for failure to conduct periodic risk assessments to sufficiently inform the design of bitFlyer’s cybersecurity program (as required by 23 NYCRR § 500.09(a)). BitFlyer […]

The post NYDFS Penalizes bitFlyer $1.2 Million for Violations to Cybersecurity Regulation appeared first on Alston & Bird Privacy, Cyber & Data Strategy Blog.

The New York State Department of Financial Services has issued an industry letter detailing the prior approval process for all New York banking organizations seeking to engage in new or significantly different virtual currency-related activity.

On October 18, 2022, EyeMed Vision Care LLC (“EyeMed”) entered into a Consent Order with the New York Department of Financial Services (“DFS”) relating to a cybersecurity event from 2020 that exposed consumer nonpublic information (“NPI”) to an unauthorized individual. EyeMed agreed to pay DFS a $4.5 million penalty, in addition to implementing mandatory remediation […]

The post NYDFS Announces Significant Cybersecurity Settlement with EyeMed Vision Care appeared first on Alston & Bird Privacy, Cyber & Data Strategy Blog.

The New York Department of Financial Services (NYDFS) issued new guidance this week intended to assist organizations in thwarting ransomware attacks. The guidance clarifies the NYDFS’ expectation that NYDFS-regulated companies should “implement these controls whenever possible” and report any successful deployment of ransomware or unauthorized access to privilege accounts to the NYDFS under its established […]

The post NYDFS Issues Guidance on Cybersecurity Controls to Combat Ransomware and Clarifies Reporting Obligations appeared first on Alston & Bird Privacy, Cyber & Data Strategy Blog.